{"id":"CVE-2026-68538","kind":"vulnerability","aliases":["CVE-2026-68538"],"related":[],"title":"fulgur: crafted CSS counters() input exhausts CPU and memory","description":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0.","summary":"fulgur, a library that converts HTML/CSS to PDF, did not bound how much work resolving the CSS counters(name, sep) function takes. A small crafted HTML/CSS payload can exhaust CPU and memory, denying service to the host and any other tenants.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fulgur","multi-tenant","package","pdf-generation","rust"],"not_affected_if":["trusted-input-only","version-0.27.0-or-later"],"how_to_check":"- Check the fulgur version in your lockfile or Cargo.toml; affected range is `0.15.0` up to but not including `0.27.0`.\n- Look for services that pass user-supplied HTML/CSS into fulgur for PDF rendering.","fix":"- fulgur: upgrade to `0.27.0`.","status":"open","published_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:31:58+00:00","updated_at":"2026-11-11T22:31:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T22:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- fulgur: upgrade to `0.27.0`.","reach":"internet","title":"fulgur: crafted CSS counters() input exhausts CPU and memory","impact":"medium","summary":"fulgur, a library that converts HTML/CSS to PDF, did not bound how much work resolving the CSS counters(name, sep) function takes. A small crafted HTML/CSS payload can exhaust CPU and memory, denying service to the host and any other tenants.","audience":"developers","category":"package","nicknames":[],"who_cares":["fulgur","rust","pdf-generation","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker exhausts server CPU and memory, denying service to co-tenants.","analyst_note":"","how_to_check":"- Check the fulgur version in your lockfile or Cargo.toml; affected range is `0.15.0` up to but not including `0.27.0`.\n- Look for services that pass user-supplied HTML/CSS into fulgur for PDF rendering.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","version-0.27.0-or-later"],"who_is_affected":"Any service that lets outside users submit HTML/CSS that fulgur renders to PDF, especially multi-tenant conversion services. Applications that only render trusted, internally authored templates are much less exposed. unknown whether the sources list other affected products.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4688,"output_tokens":541,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-68538':12A,15A '0.15.0':85C '0.27.0':89C,160C 'abl':121C 'across':115C 'aggreg':113C 'attack':120C 'base':129C 'bound':35B,101C 'co':151C 'co-ten':150C 'common':72C 'content':99C 'convers':130C 'convert':29B,67C 'counter':4A,42B,93C 'cpu':7A,54B,134C 'craft':2A,49B 'css':3A,41B,92C 'cve':10A,13A 'deni':57B,143C 'element':117C 'exhaust':6A,53B,137C 'expans':109C 'fulgur':1A,16B,25B,66C,128C 'fulgur-bas':127C 'function':45B,96C 'generat':23B,98C 'host':61B,147C 'html/css':30B,50B,69C,124C 'input':5A,78C 'issu':154C 'librari':27B 'mani':81C 'memori':9A,56B,136C 'much':37B 'multi':18B 'multi-ten':17B 'name':43B,94C 'neither':102C 'packag':20B 'patch':157C 'payload':51B,142C 'pdf':22B,32B,71C 'pdf-gener':21B 'process':77C 'resolv':39B,90C 'rust':24B 'sep':44B,95C 'server':75C 'servic':58B,131C,144C 'singl':108C 'size':105C 'small':48B,141C 'submit':123C 'suppli':79C 'take':46B 'tenant':19B,65B,82C,152C 'tree':118C 'trigger':133C 'trivial':140C 'untrust':68C 'version':84C,88C,159C 'work':38B,114C","nicknames":[],"mitigations":[],"who_affected":"Any service that lets outside users submit HTML/CSS that fulgur renders to PDF, especially multi-tenant conversion services. Applications that only render trusted, internally authored templates are much less exposed. unknown whether the sources list other affected products.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fulgur","high","multitenant","package","pdfgeneration","rust"],"campaign_type":null,"search_a":"'-2026':11A,14A '-68538':12A,15A 'counter':4A 'cpu':7A 'craft':2A 'css':3A 'cve':10A,13A 'exhaust':6A 'fulgur':1A 'input':5A 'memori':9A","search_b":"'bound':35B 'convert':29B 'counter':42B 'cpu':54B 'craft':49B 'css':41B 'deni':57B 'exhaust':53B 'fulgur':16B,25B 'function':45B 'generat':23B 'host':61B 'html/css':30B,50B 'librari':27B 'memori':56B 'much':37B 'multi':18B 'multi-ten':17B 'name':43B 'packag':20B 'payload':51B 'pdf':22B,32B 'pdf-gener':21B 'resolv':39B 'rust':24B 'sep':44B 'servic':58B 'small':48B 'take':46B 'tenant':19B,65B 'work':38B","search_c":"'0.15.0':85C '0.27.0':89C,160C 'abl':121C 'across':115C 'aggreg':113C 'attack':120C 'base':129C 'bound':101C 'co':151C 'co-ten':150C 'common':72C 'content':99C 'convers':130C 'convert':67C 'counter':93C 'cpu':134C 'css':92C 'deni':143C 'element':117C 'exhaust':137C 'expans':109C 'fulgur':66C,128C 'fulgur-bas':127C 'function':96C 'generat':98C 'host':147C 'html/css':69C,124C 'input':78C 'issu':154C 'mani':81C 'memori':136C 'name':94C 'neither':102C 'patch':157C 'payload':142C 'pdf':71C 'process':77C 'resolv':90C 'sep':95C 'server':75C 'servic':131C,144C 'singl':108C 'size':105C 'small':141C 'submit':123C 'suppli':79C 'tenant':82C,152C 'tree':118C 'trigger':133C 'trivial':140C 'untrust':68C 'version':84C,88C,159C 'work':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T22:25:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68538","severity":null,"published_at":"2026-11-11T22:17:30+00:00","modified_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129468,"url":"https://github.com/fulgur-rs/fulgur/commit/ebc75691ad368f1c1a211543313b04da2af466d6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129469,"url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.27.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129470,"url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-395p-pj7r-jm42","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T22:25:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}